CVE-2025-31985

MediumCVSS 6.5/10Last modified Jul 24, 2026

Description

HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header. This could allow browsers to perform MIME-type sniffing, potentially causing malicious content to be interpreted and executed incorrectly.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
HCL	BigFix Service Management (SM)	23

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128144Vendor Advisory

Timeline

Published: May 20, 2026
Last modified: Jul 24, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-319877.5HCL Connections Docs may mishandle validation of certain uploaded documents leading to denial of service due to resource exhaustion.CVE-2025-319884.8HCL Digital Experience is susceptible to cross site scripting (XSS) in an administrative UI with restricted access.CVE-2025-31999.8A vulnerability was found in ageerle ruoyi-ai up to 2.0.1 and classified as critical. Affected by this issue is some unknown functionality o CVE-2025-319906.8Rate limiting for certain API calls is not being enforced, making HCL Velocity vulnerable to Denial of Service (DoS) attacks. An attacker c CVE-2025-319919.8Rate Limiting for attempting a user login is not being properly enforced, making HCL DevOps Velocity susceptible to brute-force attacks past CVE-2025-319924.6HCL Unica MaxAI Assistant is susceptible to a HTML injection vulnerability. An attacker could insert special characters that are processed CVE-2025-319939.8HCL Unica Centralized Offer Management is vulnerable to a potential Server-Side Request Forgery (SSRF). An attacker can exploit improper inp CVE-2025-319944.3HCL Unica Campaign 12.1.10 is vulnerable to Reflected Cross-Site Scripting (XSS) where an attacker injects malicious script into an HTTP req CVE-2025-319953.5HCL Unica MaxAI Workbench is vulnerable to improper input validation. This allows attackers to exploit vulnerabilities such as SQL Injectio CVE-2025-319967.5HCL Unica Platform is affected by unprotected files due to improper access controls. These files may contain sensitive information such as CVE-2025-319977.5HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References (IDOR). An attacker can bypass authorization and CVE-2025-319989.8HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information. An attacker can expl